Table of contents
22
By Salman Khan, OSCP+, Founder of XHack, SRT (Synack Red Team member)
Read this in 30 seconds: Unrestricted AI models are not one thing. The label covers six different kinds of product, from OpenAI’s gated cyber programme to criminal tools sold on forums, and only some of them suit authorised security work. This guide sorts the six, scores them against what a pentester, bug hunter or malware analyst needs, and says which kind fits which job.
- “Unrestricted” can mean a model, or it can mean an access policy. Cisco Talos groups criminal use into uncensored models, jailbroken mainstream models and criminal-built LLMs, so one label covers very different products.
- Removing refusals is easy to do and hard to do well. A NeurIPS 2024 paper found refusal is mediated by a single direction in 13 open chat models up to 72B parameters, but a widely read Hugging Face post shows the edited model scoring lower on every benchmark until it was retrained.
- The big labs are moving to verified access, not to open models. OpenAI launched Trusted Access for Cyber in February 2026 and widened it in April to thousands of verified individuals, while Anthropic limited its Mythos Preview to 11 organisations.
- Local unrestricted AI models are private, but they carry no audit trail. Nothing records who ran what, and the liability for a bad run is entirely yours.
- XHack gates unrestricted access behind a government ID and a professional credential. Review takes about five minutes of your time and usually one business day, and unrestricted access starts on the $49 Professional plan.
Search for unrestricted AI models and you will find chatbots for roleplay, forum tools built by criminals, open-weight files on a model hub and a handful of serious security products, all under one label. They are not interchangeable. Picking the wrong kind costs a pentester a client, a bug hunter an account, or an analyst a clean chain of custody.
This guide is for people who do authorised security work. It explains how unrestricted AI models come to exist, sorts them into six kinds, scores each one against the needs of real engagements, and gives a decision table by job. I run XHack, so I have a financial interest in the answer, and I say where a different kind is the better fit.
A language model refuses because of two separate layers. The first is alignment: training that teaches the model to decline certain requests. The second is guardrails, extra checks wrapped around the model that try to stop harmful input or output in real time. Cisco Talos describes both in its 2025 report on criminal use of language models, and it is a useful split to keep in mind.
Unrestricted AI models take one of three routes around those layers. Some are models whose refusal behaviour was edited out or never trained in. Some are mainstream models talked into ignoring their rules, which is a jailbreak. And some are mainstream-grade models whose provider relaxed the rules for people it has checked.
That third route is the one the industry is converging on, and it is the reason “unrestricted” has two meanings that people constantly confuse. One meaning is about the model. The other is about who is allowed to talk to it.
For the longer story of why general assistants refuse offensive work in the first place, see why AI refuses hacking requests. This article assumes you already know the problem and want to choose among the answers.
The demand is not mysterious. Offensive security work lives in the part of the map where a general assistant is most likely to say no. The Next Web describes the problem plainly: standard models block sensitive queries about vulnerability research, exploit analysis and malware behaviour, and that is the gap OpenAI’s cyber variant is built to close for verified users.
For a penetration tester with a signed scope, a refusal on an in-scope task is lost time. For a malware analyst under a deadline it is worse, because the question is rarely about doing harm. It is about understanding what a sample does. Interrupted workflows are the reason people search for unrestricted AI models in the first place.
The problem is that the search results mix the useful options with the dangerous ones. That is what the rest of this guide sorts out.
There are four ways unrestricted AI models end up answering what a standard assistant would decline. Knowing them helps you judge a product quickly, because each one comes with predictable side effects.
The model was never aligned to refuse. Some open-weight base models are released without much safety tuning, and a few fine-tunes are trained specifically to comply. Talos notes that uncensored models are easy to find: using the Ollama runtime, a user can download one and run it on their own machine.
The refusal was edited out afterwards. The best-known method is called abliteration. A 2024 paper by Arditi and colleagues, presented at NeurIPS, reported that refusal in open chat models is mediated by a single direction in the model’s internal activations, found across 13 models up to 72B parameters. Removing that direction stops the refusals. The authors themselves describe current safety fine-tuning as brittle.
The model was jailbroken at run time. A prompt, or a chain of prompts, talks a hosted model out of its rules. This is not a model you can choose or rely on, because the provider patches it and the behaviour changes without notice.
The provider relaxed the rules for verified users. OpenAI’s GPT-5.4-Cyber, announced in April 2026, was described by The Next Web as a variant fine-tuned for defensive security with a lower refusal boundary, available to users OpenAI has verified as security professionals.
Only the last route hands you one of the unrestricted AI models you can show a client. The other three leave you with a model whose behaviour you cannot fully predict or account for.
Here are the six kinds, ordered from most accountable to least. Existing guides, including uncensored AI alternatives for security work and uncensored AI for hacking, use a three-way split. Six is more useful once you want to choose a model rather than avoid a scam.
| Kind | What it is | Who runs it | Access control | Typical fit |
|---|---|---|---|---|
| 1. Gated frontier models | A mainstream provider’s model with relaxed rules for verified users, such as OpenAI’s Trusted Access for Cyber | A large lab | ✅ Identity and tier checks | Defensive work, research, teams already on that vendor |
| 2. Restricted-release models | A model withheld from the public because of its capability, such as Anthropic’s Mythos Preview, limited to 11 organisations in April 2026 | A large lab | ✅ Named partners only | Not available to individuals |
| 3. Verified-access security agents | A purpose-built security product that gates unrestricted capability behind verification and logs the work | A security vendor | ✅ ID plus credential | Pentests, bug bounty, malware analysis, red teaming |
| 4. Local open-weight and abliterated models | Files you download and run yourself, including models with refusals edited out | You | ❌ None | Offline lab work, learning, privacy-first experiments |
| 5. Hosted “uncensored” consumer apps | Chat products sold on the absence of filters, often aimed at roleplay and general use | An app company | ❌ Often just an email address | Not built for security work |
| 6. Criminal-built LLMs | Tools made for fraud and malware, sold on forums | Criminal operators | ❌ Payment only | None. Avoid |
Two notes on the table of unrestricted AI models. Kind 2 exists mainly as context: it shows that the most capable security models are being gated harder, not opened up. And kind 5 is a loose bucket, so it names no products. Each app’s behaviour and policies differ, and none is designed around an engagement with a scope and a client.
The most important trend of 2026 is that the biggest labs have stopped trying to solve this with blanket refusals. They are building access control instead.
According to The Next Web’s report of 15 April 2026, OpenAI first launched Trusted Access for Cyber in February alongside a $10 million cybersecurity grant fund. The programme is an identity and trust framework: individuals can authenticate, enterprises can request team access, and an invite-only tier exists for researchers who need the most permissive behaviour. The April update scaled it to what OpenAI called thousands of verified individual defenders and hundreds of teams.
The same report says the top tier gets GPT-5.4-Cyber, and that users in that tier may be asked to waive zero data retention, so OpenAI can see how the model is used. That detail matters if you work under client confidentiality.
Anthropic took a different path. The Next Web reports that its Mythos Preview model, which Anthropic says found thousands of previously unknown vulnerabilities, is restricted to 11 organisations under a $100 million defensive initiative, and that Anthropic has said it may never release it publicly.
What this means for you: the capability of these unrestricted AI models is real, but the doors are narrow, and the terms differ by vendor. If your employer is already inside one of these programmes, use it for what it covers. If not, you need another route.
For a closer look at how verified access works in practice, unrestricted AI for penetration testing walks through it.
Running an open-weight model on your own machine is a legitimate choice, and some security work really does call for it: air-gapped analysis, sensitive samples, or simply learning how models behave. Understanding what you are getting matters.
What you gain. Nothing leaves your machine. There is no vendor to read your prompts, no policy that can change under you, and no per-token bill. Talos confirms how easy the barrier is: a local runtime plus a downloaded model is enough.
What you give up. Three things stand out.
First, quality. Larger models produce better results but need more hardware, as Talos points out, so a model that fits on a laptop is a smaller model. And editing out refusals is not free. In the Hugging Face post that popularised abliteration, the author reports that the edited Daredevil-8B scored lower than its source model across all benchmarks, and he needed an extra round of preference training to recover the quality.
Second, no audit trail. A local model does not record who ran what and when. If a client later asks how a finding was produced, you have your own notes and nothing else.
Third, no one stands behind it. If the model hallucinates a vulnerability or invents a command, the consequence is yours alone.
None of this makes local unrestricted AI models a bad idea. It makes them a tool for a specific job, which the decision table below spells out. For how to think about which tasks suit a local model, AI reverse engineering covers the offline side of analysis work.
These two kinds of unrestricted AI models share a trait: nobody asks who you are or what you are authorised to do. That is exactly what makes them wrong for professional work.
Hosted consumer apps. Many sell the idea of an AI with no filters, and many are aimed at general chat and roleplay. They are not designed around scope, authorisation or reporting. Prompts you type may be stored by a company you have no contract with, and a client’s data in that prompt is a confidentiality problem you created.
Criminal-built LLMs. Talos documents tools advertised on criminal forums, such as OnionGPT, with features that link the model to outside tools for tasks like sending email, scanning sites for vulnerabilities and checking stolen credit card numbers. Talos also notes that criminals jailbreak mainstream models. Whatever your intent, using one ties your work to criminal infrastructure and damages the thing your profession sells: a clean, legal chain of custody. Criminal operators also have no duty to protect your data or your identity.
If you want a closer look at how the criminal ecosystem is marketed and why the “alternative” searches exist at all, WormGPT alternatives for verified pros covers it.
Refusal rate is only one requirement. Unrestricted AI models are useful for security work only if they also meet the rest of this list.
| Criterion | Why it matters on a real engagement |
|---|---|
| Answers in-scope offensive tasks | The reason you wanted an unrestricted model in the first place |
| Works as an agent | Real tests need tool use, a browser, and multi-step planning, not only chat |
| Reasoning quality | A wrong exploit idea wastes hours and can break a target |
| Context length | Source trees, traffic captures and reports are long |
| Audit trail | Clients and auditors ask how a finding was produced |
| Data handling | Client data and findings should not end up in a vendor’s training or logs |
| Scope control | The tool should stop at the edge of your authorisation |
| Legality and chain of custody | Your own professional standing depends on it |
| Cost predictability | Engagements have budgets |
Now score each kind of unrestricted AI models against that list.
| Criterion | 1. Gated frontier | 3. Verified-access agent | 4. Local / abliterated | 5. Hosted consumer | 6. Criminal |
|---|---|---|---|---|---|
| In-scope offensive answers | ✅ Within the tier | ✅ After verification | ✅ | ⚠️ Inconsistent | ✅ |
| Agent with tools | ⚠️ Depends on the product | ✅ | ❌ Chat only unless you build the harness | ❌ | ⚠️ Advertised, unaudited |
| Reasoning quality | ✅ | ✅ | ⚠️ Smaller models, quality loss after edits | ⚠️ | ⚠️ |
| Audit trail | ⚠️ Vendor-side | ✅ Logged | ❌ | ❌ | ❌ |
| Data handling | ⚠️ Read the terms; top tier may waive zero retention | ✅ Local session data | ✅ Fully local | ❌ Unknown | ❌ |
| Scope control | ⚠️ | ✅ | ❌ | ❌ | ❌ |
| Chain of custody | ✅ | ✅ | ⚠️ Your own notes | ❌ | ❌ |
The pattern across unrestricted AI models is plain. The kinds that give you the strongest “no refusals” are the weakest on accountability, and the accountable kinds make you prove who you are first. That trade-off is the whole subject of this guide.
Match the job to the kind of unrestricted AI models you use, not the other way round.
| Job | Best fit | Why |
|---|---|---|
| Authorised pentest with a client and a scope | Verified-access agent | Audit trail, scope control and a defensible chain of custody |
| Bug bounty hunting inside a programme’s scope | Verified-access agent | Speed on recon and triage, and logged actions if a programme asks |
| Malware analysis on sensitive samples in a lab | Local model, or an agent running offline | Samples never leave the machine |
| Learning and experiments at home | Local model | Cheap, private and no account needed |
| Defensive research at an employer already in a gated programme | Gated frontier | Already approved and covered by existing terms |
| Anything involving someone else’s systems without permission | None | No kind of model makes that legal |
For bug hunters specifically, the XHack AI agent for bug bounty shows how a verified-access agent fits a programme workflow, and AI malware analysis covers the lab side.
Before you commit to any of these unrestricted AI models, put these questions to the vendor or the model card. A good answer is specific. A vague one is an answer too.
The rest of the checklist is about signs to walk away from.
Whatever kind of unrestricted AI models you consider, a few signs should make you stop.
Everything above assumes you have permission to test what you point the model at. Choosing among unrestricted AI models does not change that.
Get written authorisation and a defined scope before any test. Keep your work inside it. Log what you run. And follow your programme’s or employer’s rules on AI use, since several bug bounty platforms now publish rules on AI-written reports.
None of this is legal advice. The rules on tools, testing and data differ by country and by contract, so ask a lawyer if you are unsure about your own situation. XHack’s own Restrictions page is blunt about what is off-limits: testing systems you do not own or have written permission to test, creating or deploying malware, live phishing campaigns, credential harvesting, and using the agent to solve active CTF competitions, among others.
XHack sits in kind 3: a verified-access security agent. Among unrestricted AI models, the idea here is simple. Unrestricted capability is a tool, and professional tools come with accountability.
Verified access. Researcher accounts are approved on a government-issued photo ID, both sides, plus at least one professional credential such as OSCP, CEH, CISSP or Security+, or a security-related diploma. The wizard takes about five minutes of your time, review is usually decided within one business day, and reviewing your verification is free. Documents are encrypted at rest, and every reviewer access is logged. Depending on current requirements, you verify before you start, or you start with limited access, where the agent finds vulnerabilities and helps with your work but does not exploit until you verify. The details are in the verification and limited access guide.
Plans. Individual plans are $20 Starter, $49 Professional and $150 Elite a month, with a 7-day free trial, one per person. The pricing page lists unrestricted AI access, once verified, from Professional, and fully unrestricted AI, once verified, on Elite. Full details are on the pricing page.
Accountability. Every operation is logged for a chain of custody, and scope and authorisation are enforced. Each chat has its own permission mode, from manual approval of every action to read-only planning, and destructive commands such as wiping disks or dropping databases are blocked even in the most permissive mode.
Privacy. XHack does not store your agent chats. For the strictest environments you can run the desktop agent fully offline against a local model, which gives you the privacy of kind 4 with the agent tooling of kind 3.
The honest limits. The self-serve agent is agent-driven, so you validate what it finds. AI output can be wrong, our Terms say so, and XHack AI mistakes explains where our own agent gets things wrong. And verification is a real step: if you want a model with no questions asked, XHack is not it, on purpose.
For a deeper look at the agent itself, the unrestricted AI agent covers what it does and how access works, and the unrestricted AI feature page lists the full capability set.
The technique itself is published research, but the files are another matter. Download only from sources you can verify, check the publisher and the file hashes where they are provided, and run new unrestricted AI models in an isolated environment first. Treat an unofficial download link as a red flag.
Unrestricted AI models are language models, or products built on them, that answer requests a standard assistant would decline. The label covers six kinds: gated frontier models for verified users, restricted-release models, verified-access security agents, local open-weight and abliterated models, hosted consumer apps and criminal-built tools. They differ sharply in accountability, so treat them as six options, not one category.
Running a model is generally not the issue. What you do with it is. Using any model against systems you do not own or have written permission to test is illegal in most places, whichever kind of model you use. Rules differ by country and contract, so this is not legal advice, and you should ask a lawyer about your own situation.
There is no single best one among unrestricted AI models. For client work with a scope, a verified-access agent gives you an audit trail and scope control. For sensitive samples in an offline lab, a local model keeps data on your machine. For defensive work inside an employer’s existing programme, gated frontier access may already cover you.
Often, yes, for edited local unrestricted AI models. The Hugging Face post that popularised abliteration reports that the edited model scored lower than its source across all benchmarks, and the author retrained it to recover quality. Gated frontier models and purpose-built agents are not edited this way, so the loss depends on the kind.
Yes. Local open-weight unrestricted AI models run offline, and XHack’s desktop agent can also run fully offline against a local model. The trade-off is hardware: larger models produce better results but need more resources.
Because an approved account can launch scans, generate working exploit code and run adversarial probes against live systems. Verification confirms who holds that capability before it is handed over. It takes about five minutes of your time, review usually finishes within one business day, and reviewing is free.
Unrestricted AI models are a spectrum, and the right point on it depends on your job. Choosing among unrestricted AI models comes down to what you must be able to prove. The kinds that refuse least are also the least accountable, and the kinds you can show a client ask you to prove who you are first.
For authorised pentests and bug bounty work, a verified-access agent is the best balance of capability and proof. For offline lab work, a local model is a fair choice if you accept the quality and audit-trail trade-offs. Avoid hosted consumer apps and criminal tools for anything involving a client.
If you want to see how verified access works, start the 7-day free trial and read the verification guide first.
Categories
Related articles
